@@ -3,7 +3,9 @@ import fs from "node:fs/promises";
33import path from "node:path";
44import {
55ensureAuthProfileStore,
6+ensureAuthProfileStoreWithoutExternalProfiles,
67loadAuthProfileStoreForSecretsRuntime,
8+refreshOAuthCredentialForRuntime,
79resolveAuthProfileOrder,
810resolveProviderIdForAuth,
911resolveApiKeyForProfile,
@@ -50,7 +52,11 @@ export async function bridgeCodexAppServerStartOptions(params: {
5052params.startOptions,
5153params.agentDir,
5254);
53-const store = ensureAuthProfileStore(params.agentDir, { allowKeychainPrompt: false });
55+const store = ensureCodexAppServerAuthProfileStore({
56+agentDir: params.agentDir,
57+authProfileId: params.authProfileId,
58+config: params.config,
59+});
5460const authProfileId = resolveCodexAppServerAuthProfileId({
5561authProfileId: params.authProfileId,
5662 store,
@@ -88,23 +94,75 @@ export function resolveCodexAppServerAuthProfileIdForAgent(params: {
8894config?: AuthProfileOrderConfig;
8995}): string | undefined {
9096const agentDir = params.agentDir?.trim() || resolveDefaultAgentDir(params.config ?? {});
91-const store = ensureAuthProfileStore(agentDir, { allowKeychainPrompt: false });
97+const store = ensureCodexAppServerAuthProfileStore({
98+ agentDir,
99+authProfileId: params.authProfileId,
100+config: params.config,
101+});
92102return resolveCodexAppServerAuthProfileId({
93103authProfileId: params.authProfileId,
94104 store,
95105config: params.config,
96106});
97107}
98108109+function ensureCodexAppServerAuthProfileStore(params: {
110+agentDir?: string;
111+authProfileId?: string;
112+config?: AuthProfileOrderConfig;
113+}): ReturnType<typeof ensureAuthProfileStore> {
114+return ensureAuthProfileStore(params.agentDir, {
115+allowKeychainPrompt: false,
116+config: params.config,
117+externalCliProviderIds: [CODEX_APP_SERVER_AUTH_PROVIDER],
118+ ...(params.authProfileId ? { externalCliProfileIds: [params.authProfileId] } : {}),
119+});
120+}
121+122+function resolveCodexAppServerAuthProfileStore(params: {
123+agentDir?: string;
124+authProfileId?: string;
125+authProfileStore?: AuthProfileStore;
126+config?: AuthProfileOrderConfig;
127+}): AuthProfileStore {
128+const overlaidStore = ensureCodexAppServerAuthProfileStore({
129+agentDir: params.agentDir,
130+authProfileId: params.authProfileId,
131+config: params.config,
132+});
133+if (!params.authProfileStore) {
134+return overlaidStore;
135+}
136+const order =
137+params.authProfileStore.order || overlaidStore.order
138+ ? {
139+ ...overlaidStore.order,
140+ ...params.authProfileStore.order,
141+}
142+ : undefined;
143+return {
144+ ...params.authProfileStore,
145+ ...(order ? { order } : {}),
146+profiles: {
147+ ...overlaidStore.profiles,
148+ ...params.authProfileStore.profiles,
149+},
150+};
151+}
152+99153export async function resolveCodexAppServerAuthAccountCacheKey(params: {
100154authProfileId?: string;
101155authProfileStore?: AuthProfileStore;
102156agentDir?: string;
103157config?: AuthProfileOrderConfig;
104158}): Promise<string | undefined> {
105159const agentDir = params.agentDir?.trim() || resolveDefaultAgentDir(params.config ?? {});
106-const store =
107-params.authProfileStore ?? ensureAuthProfileStore(agentDir, { allowKeychainPrompt: false });
160+const store = resolveCodexAppServerAuthProfileStore({
161+ agentDir,
162+authProfileId: params.authProfileId,
163+authProfileStore: params.authProfileStore,
164+config: params.config,
165+});
108166const profileId = resolveCodexAppServerAuthProfileId({
109167authProfileId: params.authProfileId,
110168 store,
@@ -292,7 +350,11 @@ async function resolveCodexAppServerAuthProfileLoginParamsInternal(params: {
292350forceOAuthRefresh?: boolean;
293351config?: AuthProfileOrderConfig;
294352}): Promise<CodexLoginAccountParams | undefined> {
295-const store = ensureAuthProfileStore(params.agentDir, { allowKeychainPrompt: false });
353+const store = ensureCodexAppServerAuthProfileStore({
354+agentDir: params.agentDir,
355+authProfileId: params.authProfileId,
356+config: params.config,
357+});
296358const profileId = resolveCodexAppServerAuthProfileId({
297359authProfileId: params.authProfileId,
298360 store,
@@ -388,14 +450,38 @@ async function resolveOAuthCredentialForCodexAppServer(
388450agentDir: params.agentDir,
389451 profileId,
390452});
391-const store = ensureAuthProfileStore(ownerAgentDir, { allowKeychainPrompt: false });
453+const store = ensureCodexAppServerAuthProfileStore({
454+agentDir: ownerAgentDir,
455+authProfileId: profileId,
456+config: params.config,
457+});
458+const persistedStore = ensureAuthProfileStoreWithoutExternalProfiles(ownerAgentDir, {
459+allowKeychainPrompt: false,
460+});
461+const persistedCredential = persistedStore.profiles[profileId];
462+const persistedOAuthCredential =
463+persistedCredential?.type === "oauth" &&
464+isCodexAppServerAuthProvider(persistedCredential.provider, params.config)
465+ ? persistedCredential
466+ : undefined;
392467const ownerCredential = store.profiles[profileId];
393-const credentialForOwner =
468+const overlaidOAuthCredential =
394469ownerCredential?.type === "oauth" &&
395470isCodexAppServerAuthProvider(ownerCredential.provider, params.config)
396471 ? ownerCredential
397- : credential;
398-if (params.forceRefresh) {
472+ : undefined;
473+const credentialForOwner = persistedOAuthCredential ?? overlaidOAuthCredential ?? credential;
474+if (params.forceRefresh && !persistedOAuthCredential && overlaidOAuthCredential) {
475+const refreshedRuntimeCredential = await refreshOAuthCredentialForRuntime({
476+credential: overlaidOAuthCredential,
477+});
478+if (!refreshedRuntimeCredential?.access?.trim()) {
479+throw new Error(`Codex app-server auth profile "${profileId}" could not refresh.`);
480+}
481+store.profiles[profileId] = refreshedRuntimeCredential;
482+return refreshedRuntimeCredential;
483+}
484+if (params.forceRefresh && persistedOAuthCredential) {
399485store.profiles[profileId] = { ...credentialForOwner, expires: 0 };
400486saveAuthProfileStore(store, ownerAgentDir);
401487}
此内容由惯性聚合(RSS阅读器)自动聚合整理，仅供阅读参考。 原文来自 — 版权归原作者所有。